为何“网络末日”可能对中国冲击更大

Chang Che is a writer and contributor to the New Yorker.

In August, researchers at a California security firm used an OpenAI model to find a software bug in PHP, a programming language that undergird some seventy per cent of the world’s websites, including Wikipedia and WordPress. They alerted PHP’s developers, who quietly began working on a fix. By late October, the fix was ready, but before they could alert the world, the break-in attempts had begun. Days earlier, Amazon detected someone trying to hack into its servers; attacks code began circulating online. Some governments and companies began pulling websites down, rather than risk a security breach. One security firm described the flaws as some of the worst ever found in PHP, “and arguably in software history.”

Before AI, the internet might have looked, to a hacker, like a worn-out bug screen. You could discern some holes with a keen eye, and that knowledge was reliably asymmetric—others probably didn’t know about the holes you found. Moreover, tunneling through the holes undetected took months or years of human labor, talent, and money. Now, with AI, the internet looks more like a block of Swiss cheese: the holes are obvious, anyone can, or will, see them, and the time and cost it takes to exploit these software flaws have plunged alarmingly fast. According to Google’s incident response team, the average time it takes for cyber criminals to exploit a new vulnerability is -7 days, meaning hacking attempts are “routinely occurring before a patch is even released.”

Hackers refer to unbeknownst software bugs like PHP as “zero-days” because a defender has had zero days to protect themselves upon its discovery. Once a hacker discovers a zero-day in, say, iOS software, every iPhone user is potentially vulnerable to a hack until Apple finds out about it, fixes it, releases a new patch, and, crucially, gets customers to install the software update. Beyond losing your crypto-wallets, there is the question of what the cyberpocalypse means, strategically, for the United States and China. According to the data tracking site Censys, the two countries reacted at drastically different speeds to the PHP zero-day. One week after its public disclosure, the United States had successfully patched over a quarter of the 14 million services exposed to the flaw. (Japan had about the same percentage.) China, by contrast, had patched an abysmal 4% of its potentially vulnerable services.

ChinaTalk is a reader-supported publication. To receive new posts and support our work, consider becoming a free or paid subscriber.

Why was China, who spent a decade building up a formidable cybersecurity governance system, so slow to patch one of the biggest software flaws in history? Until now, the cybersecurity industry was largely built around finding flaws. Companies buy them from hackers, and governments hoard them to spy on their enemies. An industry built around bug-discovery seems to resemble the AI race or the Manhattan Project: it’s a question of how a state can marshall a small elite group toward a specific goal. China is very good at the former—as it has repeatedly demonstrated with AI, semiconductors, batteries, robotics.

We are now moving from an era of zero-day scarcity to zero-day abundance. Bugs that Washington, Moscow, and Beijing used to hoard like nuclear fission material are now becoming available to an educated AI user. An era of zero-day abundance will force cybersecurity to shift to an industry built around fixing flaws as fast as humanly, or superhumanly, possible. This is a challenge for the many, not the few—it demands something from your average IT person at a school, the contractor running a local water plant, a security team at a tech firm whose warnings may have previously been ignored. It’s almost a test of the metabolism of a society: how well bottom-up incentives are working. China, with its Leninist governance system, may have trouble in an era that demands such uncoordinated, yet collective, actions.

Hayek and the birth of disclosure norms

“Zero-days,” unlike proofs, can be weaponized, and in the 1990s, there were practically no rules for what one should do with the ingredients of a potential cyber-nuke. “White hat” hackers—people who hack to help shore up defenses—who told companies about their flaws were often ignored, bullied, or threatened with lawsuits. So hackers began posting the flaws publicly. This forced companies to fix them, but it also handed “black hat” hackers the cyber equivalent of a bank’s blueprint, so a deal had to be brokered. Entire books have been written about the battle between the hacker community and tech companies, but the upshot was that by the 2010s, an equilibrium solidified. Under the rules of “coordinated vulnerability disclosure,” a researcher notifies the affected company first, gives them time to fix it, then tells the world.

Today, a web of institutions and standards, anchored in the United States, underwrite these norms. Google’s Project Zero, an elite bug-hunting team, gives software makers 90 days to fix a flaw before it goes public. The “bug bounty” program, which Netscape pioneered in 1995, went from a quirky experiment to an industry standard that can pay hackers six figures for a single flaw. Serious bugs get an ID number from CVE, a catalog run by the US government. What’s striking is that no one designed this system from the top-down. It more closely resembled Friedrich Hayek’s theory of “spontaneous order”: free, commercially motivated groups—hackers and companies—adjusted to each other and the rules and institutions emerged. Hackers wanted credit and rewards; firms needed time. Money supplied the incentives for a bug-patching ecology that resulted in a more secure web.

One way to measure how American this metabolic process is is to compare the maturity of bug bounty programs in other countries. Out of the ten largest tech companies in the United States, nine of them have bug bounty programs, according to a 2026 study; in China, the number is six out of ten. (The firms that have them, like Alibaba, are international facing, while the ones that don’t are state-owned like China Mobile.) The pay scale is incomparable. Apple and Google can pay millions of dollars for critical zero-day flaws, while top Chinese programs like Tencent top out at $15,000. The West underwrites the ecosystem for patching up the internet.

After Snowden

Of course, this state of affairs didn’t last. While the bug-disclosure norms were taking shape, there was also a parallel, secretive cyber-arms-trade going on. In This Is How They Tell Me the World Ends, published in 2021, the former New York Times cybersecurity reporter Nicole Perlroth shows how the NSA was secretly buying zero-days from hackers to spy on American citizens and the world. Hackers were paid life-changing sums to keep their flaws secret, and the exposure of this hoarding by the Snowden leaks helped break up the love affair between Chinese hackers and Western bug bounty programs.

The Snowden revelations in 2013 catalyzed China’s cybersecurity arms race. In 2014, Xi Jinping took charge of a newly empowered cybersecurity division. Beijing began to pass laws to de-Americanize China’s tech stack, and state-sponsored cyberattacks on the United States skyrocketed. Among the biggest changes China implemented was to treat zero-days like national security assets. In 2018, Chinese hackers abruptly disappeared from the international hacking contests they once dominated. Contributions by Chinese researchers to Microsoft bug bounty programs plummeted in 2020. A year later, in 2021, Beijing passed a law that prohibited Chinese security researchers from publicizing zero-day flaws or passing them to a foreign bug-broker. They can report the bug to the company that runs the software or to China’s Ministry of Industry and Information Technology (MIIT). Any company in China that learns of a flaw has 48 hours to tell the ministry.

For decades, Western tech companies and white hat hackers had created a bug-fixing ecosystem that prized openness and defense. Chinese hackers participated, not least for the money and fame, but because fixing those bugs hardly felt “western” when Chinese offices ran Windows and Chinese phones ran Android. But it’s understandable why—in light of the NSA’s resolve to enlist US tech companies as a “backdoor”—China felt queasy about watching their hackers patch Microsoft’s bugs.

The NSA’s security rationale had a name: “nobody but us,” or NOBUS. Deliberately keeping the internet vulnerable was acceptable, in this view, as long as no other country knew about those vulnerabilities and could exploit it. In sourcing and keeping zero-days a secret for cyberoffensive capabilities, the US government undermined the global disclosure system its own society midwifed. China’s cybersecurity laws were the response to NOBUS. The message was: “if you are going to hoard zero-days to spy on us, we’re going to do the same.” Several experts described the 2021 law to me as a “vacuum” that siphons zero-days to what researchers at the Atlantic Council, a D.C.-based think tank, found is a national database visible to China’s spy agency. The rules were put to the test less than three months later, in 2021, when an Alibaba researcher found one of the worst software flaws in a decade in a free code base maintained by the Apache Software Foundation, a US-based nonprofit. He reported it to Apache as global norms prescribe, and MIIT suspended a partnership with Alibaba as punishment.

China used the force of law to compel its hackers to replicate the NSA’s zero-day arsenal, and it seems to have worked. Perlroth told me that after the zero-day vacuum law, the number of zero-day exploits from China-linked hackers exploded. “China was using their authoritarianism and these new laws to their advantage,” she told me. “It was an incredible up-leveling.” But what it couldn’t copy well was the West’s vulnerability disclosure ecosystem, a bottom-up process that enlists the hacker community and tech companies to work together to patch bugs with relative transparency. The issue is one of incentives. None of the cybersecurity laws encourage Chinese researchers to find bugs at all. In fact, the 2021 law closes off foreign bug-brokers who pay good money, and forbids the public disclosures that bestow researchers street cred. “Chinese bug bounty platforms offer limited incentives for hackers, with rewards often being unspecified or relatively low,” a 2024 report on China’s cyber ecosystem concluded. In trying to arm itself with cyber-weapons, China undermined its own cyber-immune system.

China’s AI labs and tech giants are trapped in the early 2000s Silicon Valley mindset of “move fast and break things.” There’s too much competition, profit-margins are razor thin, and the laws are already too cumbersome to invest in such luxuries as vulnerability infrastructure and, relatedly, AI safety. The private sector is very responsive to state diktats, which has the unforeseen consequence of failing to incentivize firms to do anything beyond what is required of them. A crackdown, I believe, is too blunt a weapon for the metabolism needed to patch a constant flood of zero-day discoveries.

Now let’s return to the cyberpocalypse.

The Death of NOBUS

Perlroth’s book ends in 2021, when US adversaries—Russia, Iran, China, North Korea—have learned to collect and weaponize “zero-days” like the NSA. Even before the arrival of ChatGPT, a cyberweapons arms race was well underway, and China serves as a successful model of securitizing software bugs. I recently spoke to Perlroth to ask her what she made of the post-Mythos landscape. For one, everyone wants to know when her sequel is coming, but Perlroth is reluctant: things are moving so fast, she said, that anything she writes will be outmoded. Second, the zero-day gray market she covered, where contractors bought software bugs from hackers and sold it to governments, is likely “being decimated.” “Why would a government pay millions of dollars for something they can just find with a model for $450?” Perlroth told me.

But the biggest takeaway from our conversation is that this new era of zero-day abundance is going to shift the industry toward fixing flaws ASAP. In a world of zero-day scarcity, it might have made sense to keep some software bugs secret to maintain some cyberoffensive options. By now, it is increasingly moronic for a state to assume it has a monopoly on a software vulnerability an AI hasn’t found. And so, all the holes need to be plugged. “It’s the death of NOBUS,” Perlroth told me. “All of the incentives point to: if you find something, you better get it fixed as quickly as possible, because the models will find it too.”

Since 2014, China has built a competitive cyber-offensive ecosystem organized around NOBUS-like rules. But now with AI, the MSS faces a “use it or lose it” situation, where their existing zero-days will soon be discovered and patched. Meanwhile, China’s increasingly de-Americanized tech stack is looking more and more like Swiss Cheese.

I think America, with its civil society and self-correcting mechanisms, can tackle their Swiss Cheese problem better than China. American tech companies that fail to protect their customers face costly class-action lawsuits and humiliating headlines in the New York Times. Companies like Microsoft are also powerful enough in the U.S. to assert their interests over the NSA. In China, by contrast, security priorities override all else.

In my recent New Yorker piece, I covered the work of political scientist Jeff Ding, who argued that Communist systems are often good at being “first” to a technology, say Sputnik, but bad at diffusing it across society. For years, the West, anxious about its own decline, has tried to out-China China, advocating for autocratic solutions to its problems. But in cybersecurity, it was the bottom-up debates of a community of idiosyncratic hackers and corporate titans that spawned the immune system against cyber threats. I think Americans need to rediscover what made its society so adaptive. That may be the masterkey to weathering the cyberpocalypse.

ChinaTalk is a reader-supported publication. To receive new posts and support our work, consider becoming a free or paid subscriber.